sanchar saathi android app - comprehensive security & privacy analysis

the sanchar saathi app is a government utility mandated by the department of telecommunications for device verification and fraud reporting. this comprehensive analysis examines the decompiled source code to understand its data collection practices, security posture, and potential privacy implications.

executive summary

this analysis examines the decompiled source code to understand data collection practices, security posture, and potential privacy implications of the sanchar saathi application.

key findings

background & context

why this analysis?

the government is mandating companies to install sanchar saathi, raising concerns about:

• privacy: what data does it collect?
• surveillance: can it be used for mass surveillance?
• security: is the data protected?
• transparency: what happens to collected data?

app purpose

according to official documentation:

• verify mobile device genuineness (imei validation)
• report lost/stolen phones
• fraud reporting via "chakshu" feature
• know your mobile (kym) registration

decompilation source

permission analysis

declared permissions

the AndroidManifest.xml declares the following permissions with varying levels of risk:

permission request flow

%%{init: {'theme':'dark', 'themeVariables': { 'actorBkg':'#1e40af','actorBorder':'#3b82f6','actorTextColor':'#fff','actorLineColor':'#60a5fa','signalColor':'#60a5fa','signalTextColor':'#fff','labelBoxBkgColor':'#374151','labelBoxBorderColor':'#60a5fa','labelTextColor':'#fff','loopTextColor':'#fff','noteBorderColor':'#10b981','noteBkgColor':'#065f46','noteTextColor':'#fff','activationBorderColor':'#10b981','activationBkgColor':'#065f46','sequenceNumberColor':'#fff','fontSize':'15px'}}}%%
sequenceDiagram
    participant U as 👤 User
    participant F as 📱 Flutter UI
    participant S as ⚙️ SathiMainActivity
    participant A as 🔐 Android System
    
    U->>F: Initiate feature
(e.g., Fraud Report)
    activate F
    F->>S: Request permission
via MethodChannel
    activate S
    S->>A: requestPermissions()
    activate A
    A->>U: Show permission dialog
    deactivate A
    U->>A: Grant/Deny
    activate A
    A->>S: onRequestPermissionsResult()
    deactivate A
    S->>F: Return permission status
    deactivate S
    F->>U: Enable/Disable feature
    deactivate F
            

code reference: SathiMainActivity.java:240-297

data collection & privacy

1. sms data extraction

code location: sources/Q3/c.java

// Q3/c.java - Lines 28-47
Cursor query = context.getContentResolver().query(
    Telephony.Sms.Inbox.CONTENT_URI,
    new String[]{"address", "body", "date"},
    "sub_id = ? AND date >= ?",
    strArr,
    "date DESC LIMIT " + Integer.toString(i5)
);

// Extracts:
hashMap.put("ADDRESS", string);      // Sender phone number
hashMap.put("BODY", string2);        // FULL MESSAGE BODY
hashMap.put("DATE24HR", format);     // Timestamp
hashMap.put("DATE12HR", format2);    // Formatted timestamp

what it collects:

• address: sender phone number (🔴 reveals contacts)
• body: full message content (🔴 complete surveillance)
• date: timestamp (🟠 activity timeline)
• filter: last 29 days (~1 month of data)

2. call log extraction

code location: sources/Q3/b.java

// Q3/b.java - Lines 31-72
Cursor query = context.getContentResolver().query(
    CallLog.Calls.CONTENT_URI,
    new String[]{"number", "date", "duration", "name", "type"},
    bundle,
    null
);

// Extracts:
hashMap.put("NUMBER", string);           // Phone number
hashMap.put("DURATION", str2);           // Call duration
hashMap.put("CACHED_NAME", string3);     // Contact name from phonebook
hashMap.put("CALL_TYPE", callType);      // MISSED/REJECTED/INCOMING
hashMap.put("DATE24HR", format);         // Timestamp

what it collects:

• number: phone number (🔴 reveals contacts)
• cached_name: contact name from phonebook (🔴 identity exposure)
• duration: call duration (🟠 communication patterns)
• call_type: missed/rejected/incoming (🟠 behavioral data)
• filter: last 29 days, incoming only

3. persistent device tracking

code location: SathiMainActivity.java:318-324

// SathiMainActivity.java - Lines 318-324
    try {
        return Base64.encodeToString(
            new MediaDrm(new UUID(-1301668207276963122L, -6645017420763422227L))
                .getPropertyByteArray("deviceUniqueId"),
            2
        );
    } catch (Exception unused) {
        return "";
    }
}

tracking details:

• method: mediadrm uuid (🔴 persistent across factory resets)
• uuid: widevine drm id
• persistence: survives factory reset on some devices (🔴 permanent tracking)
• uniqueness: device-specific (🔴 cannot be changed)
• purpose: device fingerprinting (🔴 cross-app tracking possible)

4. sim card information

code location: SathiMainActivity.java:330-347

// SathiMainActivity.java - Lines 330-347
public final String n0(Context context) {
    HashMap hashMap = new HashMap();
    SubscriptionManager subscriptionManager = 
        (SubscriptionManager) context.getSystemService(SubscriptionManager.class);
    
    List<SubscriptionInfo> activeSubscriptionInfoList = 
        subscriptionManager.getActiveSubscriptionInfoList();
    
    for (SubscriptionInfo next : activeSubscriptionInfoList) {
        int simSlotIndex = next.getSimSlotIndex();           // SIM slot (0/1)
        String charSequence = next.getCarrierName().toString(); // Carrier name
        next.getSubscriptionId();                            // Subscription ID
        hashMap.put(String.valueOf(simSlotIndex), charSequence);
    }
    return hashMap.toString();
}

what it collects:

• sim slot index: 0, 1 (🟡 dual sim detection)
• carrier name: "airtel", "jio" (🟠 service provider tracking)
• subscription id: unique sim identifier (🟠 sim tracking)

data flow diagram

%%{init: {'theme':'dark', 'themeVariables': { 'primaryColor':'#3b82f6','primaryTextColor':'#fff','primaryBorderColor':'#2563eb','lineColor':'#60a5fa','secondaryColor':'#10b981','tertiaryColor':'#ef4444','noteBkgColor':'#1f2937','noteTextColor':'#fff','fontSize':'16px'}}}%%
flowchart LR
    A["👤 User Device"] -->|"1. SMS Content"| B["📧 Q3/c.java"]
    A -->|"2. Call Logs"| C["📞 Q3/b.java"]
    A -->|"3. Device UID"| D["🔐 MediaDrm"]
    A -->|"4. SIM Info"| E["📱 SubscriptionManager"]
    A -->|"5. IMEI/IMSI"| F["📡 TelephonyManager"]
    
    B --> G["🗄️ SQLCipher DB"]
    C --> G
    D --> G
    E --> G
    F --> G
    
    G -->|"When Online"| H["🔄 NetworkWorker"]
    H -->|"HTTPS"| I["🌐 api.sancharsaathi.gov.in"]
    
    style A fill:#1e40af,stroke:#3b82f6,stroke-width:3px,color:#fff
    style B fill:#374151,stroke:#60a5fa,stroke-width:2px,color:#fff
    style C fill:#374151,stroke:#60a5fa,stroke-width:2px,color:#fff
    style D fill:#374151,stroke:#60a5fa,stroke-width:2px,color:#fff
    style E fill:#374151,stroke:#60a5fa,stroke-width:2px,color:#fff
    style F fill:#374151,stroke:#60a5fa,stroke-width:2px,color:#fff
    style G fill:#065f46,stroke:#10b981,stroke-width:3px,color:#fff
    style H fill:#374151,stroke:#60a5fa,stroke-width:2px,color:#fff
    style I fill:#991b1b,stroke:#ef4444,stroke-width:3px,color:#fff
            

security assessment

1. local data protection

2. network security

3. root detection

risk assessment

privacy risks

overall risk score

recommendations

for users

conclusion

summary

the sanchar saathi app is a legitimate government utility with no evidence of malicious behavior. the app functions as intended for device verification and fraud reporting. however, it possesses extensive data collection capabilities that raise significant privacy concerns.

transparency note

this analysis is based on static code analysis of the decompiled apk. dynamic analysis (runtime behavior monitoring) would provide additional insights into actual network traffic, backend api endpoints, data encryption in transit, and server-side data storage.

external references